Product
Pingvin Share X
An open-source file-sharing platform affected by an account takeover vulnerability caused by a flaw in the email auto-linking logic used during OAuth login.
Timeline (last 90 days)
Oct 12
The three open-source projects Pingvin Share X, Better Auth, and AshAuthentication all trusted the email field returned by the OAuth provider without confirming whether the email was verified (or without distinguishing the registration and linking flows), causing a stranger's OAuth login to be bound to someone else's account and achieving account takeover.
Unverified50%